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(54) TUIe: METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCT FOR ADAPTIVE LOGGING 



(57) Abstract 

A method, system, and computer program product 
provides adaptive loggiug. Logging events are filtered 
and stored locally based ( on least one initial logging 
level. The stored logging events ac flushed to a remote 
log server when a flush policy criteria is met The 
initial logging level and flush policy criteria can be set or 
changed adaptively from a remote site. The initial logging 
level determines which priority levels of logging events 
are filtered and stored in a temporary local site. The 
flush policy determines when the filtered logging events 
are forwarded from the local site to a remote log server 
and persistent log store. 
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Method, System and Computer Program Product for 

Adaptive Logging 

Background of the Invention 

Field of the Invention 

The present invention pertains to the field of network system 
administration. In particular, the present invention relates to obtaining, 
managing, and controlling log information on events in a network. 

Related Art 

Networks link many users. A distributed network, such as the Internet, 
links users from a variety of locations. Users can engage other users in real-time, 
interactive applications over a network. Examples of real-time, interactive 
applications include multi-player gaming applications and chat programs. On- 
line services further support real-time, interactive applications over a network. 
On-line services work to ensure a good user experience. For example, an on-line 
service, such- as, MPLAYER offered by Mpath Interactive, Inc. at 
www.mplay er. com, supports m^tctiihg, chat," knil ; gamulg facilities . 

' hogging infbnnatidtf^ 
and m particular, during the execution of an interactive application by multiple 
users. Logging information can be any type of information that is desired to be 
logged - For example, logging; ihfphnation can include any type of transactional 
and/qr event log message generated during execution of an interactive gaming 
application. Logging information can include statistical, debug, and error 
■ information/; : 

System administrators rely on logging information to -monitor the 
performance of an on-line service and ensure a high quality usc<r experience. 
System administrators can establish where logging will occur and what type of 
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information will be logged. Such logging control, however, is typically limited 
to setting an initial logging level. Adaptive logging control responsive to real- 
time events is, not provided. . : ..• ' . 

For : example,: in an on-line sen/ice such as Mplayer^ a system 
administrator module is connected to a log server and multiple application servers 
through a network. The application servers forward logging information to the 
log server for storage in a log* store. Filters or Joggers, are provided at each 
application server to filter the logging information which is generated and sent 
to .the,, log server. Through the, system>.administrator module, - a system 
administrator can se^ the.filters so. that all, application servers log 

all logging information including statistical, debug aniierror infioipiation. In this 
way, the admimstrfitor controls the level of logging. The system administration 
modules!?© generates r^r^entatiqns of the past or current performance of each 
application server. If problem is reported at a particular application server, the 
system admiiusteator cmreyiew information to diagnosis or trace 

the problem. ... , - r . „ t . { ri . t _ v ,- f , ? . ,- r . . fl . . 

As the number of users increases and on-line 7 service .complexity, 
increase^, system administrators face . an increasing amount of logging 
information. In setting an ^initial Jogging leivel^system. administrator^ face 
tradeoff between the level of logging detail, ami {he, cost to, store and review 
stored log^g infonnation if 
a sys^m a^inistntor sets. a low logging level of ^.detaiLtp log all statistical, 
debug and error mfoimation thra of^stpred logging infonnatipn.can 

soon be quite large. Further this logging infoi^ation is stored even when a user 
has a good experience. These factors increase bpth personnel costs and storage 
costs. Troubleshooting and error.tracingbecpme? moretime-consuming;because 
a system administrator must sift through more irrelevant information. If the 
logging level is increased (i.e., increased to a higher level so thatless information 
is logged) to log only error information, important information for debugging and 
statistical purposes, is. lost. ,. , ir 
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Efficient, adaptive logging is needed. A system administrator needs be 
able to collect, sufficient logging information to identify when and where 
problems occur and what types of problems occur without having to collect an 
excessive amount of logging information based on an initial low logging level 

only. ; . - ; v.- ; • ; ■: * • -jl- * v.> * 

\ Summary of the Invention - - ^ ! ' ' ^ 

The present invention pro vides a metric 
product for adaptive loggirig>I^g$rig everits are fibred and scored locally biased 
on at least one initial logging leveE The ^tdred logging eVehts are flushed to a 
remote log Server wh^en & flush policy Criteria is^met: The initial logging level 
and flush policy criteria citt be set or changed adaptively ffdm i remote site. The 
initial logging level deteririities whI6h pribrity levels bftoggirig events aife filtered 
and stored in a r tempdraty local site; : The flush pblicy deteririitfes wheri'tfie 
filtered logging events are forwarded from the local site to a remote Idg'server 
andpfemstentlogstore. 5 ; 1 11 - ">^ • r ^~ 
: - in one embodiment bf ihe present invention; :: a syfetem- for adaptively 
lbgging at a T hbdcriricludesit least brie elates logger, a node logger, and at least brie 
local iog cache. Eaiih class logger is dbupled 'to at least one local log cache. Tlie 
node logger is coupled between each local log cachVahd a remote log seiver; 
Each class logger filteVs logging wents^ fbr a' 

based briaf le^tbrie ffie filtered logging events 

to a respective ' at least one 166S1 fog -cache for stbiigel The node logger 
determirite whether a fliish : policy criteria is met; The node logger flushes the 
stored filtered lbggiiig eve'rits to the remote log "server when the flush policy 
criteria is met" ' ~- - *"' ,r - r - : " " ; ' 

An adaptive logging controller enables one to set of change at least one 
initial logging level for each respective class logger arid to set or change a flush 
policy criteria for the node logger. In one example implementation, the adaptive 
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logging controller sends commands to set or change the at least one logging level 
from a remote system administrator over the Internet to each class logger. In this 
way, thp number of logging levels which are logged can be adaptively increased 
or decreased. According to a further feature, commands can be defined in a name 
space .based on class names.. The adaptive logging controller also; sends 
commands to set or ch^ge the flush policy from the remote system administrator 
over the Internet to the npde logger, In this way, the number of filtered logging 
events forwarded to a remote log server can be adaptively increased or decreased. 

In one example implementation of the present invention, adaptive logging 
is provided in an on-line service linking multiple users over a network. The on- 
line service can support any interactive service or program, including but not 
limited to, chat and n^ultirpiayer^ gaming applications. The. network can be any 
public and/or proprietary network. In one embodiment, the on-line service 
includes an application server at a node in a networt^, such as, the Internet. The 
application server includes at least one class logger, a node logger, and at least 
one local log cache. The on-line service also includes a log server and a 
persistent log store. The log server is coupled over the network to the 
application server. A system administrator module includes an adaptive logging 
cpntroller. The adaptive logging controller is coupled over the network to the 
application server. The adaptive logging controller enables one to set or change 
the initial logging level for each respective class logger and to s et or change flush 
policy criteria for the node logger. ^ _ ^ 

For example, the initial logging level c^n ,be set to, log- all debug, 
statistical, and error information locally at a particular node. The flush policy 
criteria can be set to flush the logged urformation only when 3 or more error 
messages or error logging events have been received in less than an hour. In this 
way, detailed logging information can be collected but if a user has a good 
gaming or chat experience (generating few or no error messages) the detailed 
information is discarded and does not hinder or waste the resources of the system 
log server or persistent log store. On the other hand, if the user experience is poor 
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(generating more error messages), the flush policy criteria is met and the detailed 
logging information is forwarded to the log server and persistent log stor e. In this 
way, a system administrator can review the detailed log information in the 
persistent log store to troubleshoot arid diagnosis problems: Further, the system 
administrator's burden is m&de easier ^ he or she' is' reviewing less irrelevant 
logging information from good gaming or chat experiences. ^ 

■ Further embodiments, features, arid advantages of the present inventions, 
as well as the structure arid operation 6f the various embodiments of thepreserit 
invention, ire described in' detail below- with -referent to fhfe - accompanying 
drawings. — " " ■ ^-Ar.. r^:?-'. ■■ •' ^ i< - j *. 

: -Brief Description of the -Figures 

The accompanying drawmj^, wH a 
part bf the specification, illustraie tlie present invientiori arid, together with the 
descriptionrfurther seirvbto expiairi the principles of the invention arid io enable 
a person skilled in the pertinent aLiito make and use the" invention; 
In the drawings : ' " 

FIG. T is a diagram of an example on-line service envirbnrrieht that 
supports adaptive logging according to the present invention. * 

FIG. 2 "iai a. diagniiri of in application server with adaptive Ibggirig 
according to one embodiment of the present invention. ' * " 
" : " FIGs. 3 A arid 3B are flowcharts of a routine for adaptive logging 
according to one embodiment of the present invention* * 
FIG. 4 is an example log message. 
FIG. 5 is "S table of example levels of tog messages. 
" ' FI(j. 6 is an example computer system arid cdriiputer program product in 
which the present invention is implemented prifriarily in software! 
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,The present invention will now be described with reference to the 
accompanying drawings. Jn the . drawings, like reference numbers indicate 
identical or functionally similar elements. Additionally, the left-most digit(s) of 
a reference number identifies the drawing in which the reference number first 
appears. . - . - . . t . , t . _ 

Detailed Description of the Preferred Entbodi 

/. Overview and Discussion ( v u ■ v 

The present-invention provides a method; system, and computer program 
productfor adaptive logging; sThe present ^iaventidtf-iis described in terms of an 
on-line sewice, such as^.a multi-player gaming and chat service on the Internet 
Description in these terms is provided for convenience only . It is not intended 
that the invention be limited to application in this* example environment In' faet, : 
afterreading the following description; itwill become apparent to a person skilled 
in the relevant art how to implement the invention in alternative environments 
known now or. developed in the future. ^ ~- -0 ;~ , : . - ji> : . . v. :r- v-. ; * 

IL Terminology i. ■ ■ '..v j...v . -..*ir:r ^ll w i.-::r . 

To more, clearly delineate the present invention^ an effort ' is made : 
throughout the specification to adhere; to: the 1 following ti^^defihitibns ^ 
consistently as possible. -mv -A -i; vin. jlo* rj '\v - ^ : - ; r ^- 

The. terms "log event," "logging event; "^ ! log message" or "logging 
information" areused interchangeably to refer to any type of logging information 
or other information desired to be collected including* but not libited to, the 
example logging message shown in FIG: 4. Examples of logging information 
include debug, statistical, and error information; 1 
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The term "adaptive logging" refers to any logging performed according 
to the present invention that involves an initial logging level and/or a flush policy 
criteria. For example, logging is "adaptive" in'that an initial logging level used 
to filter logging events can be set or changed in response to logging activity r 
5 Likewise, the flush policy criteria used to trigger the flushing of the filtered ' ' 

logging events can be set or changed in response to logging activity. Further, the 
flush poUcycriteriacan be sefor changed independentof tfie initial logging level. 

III. Adaptive Logging v >/v * r 

FIG. 1 shows an example network ^architecture K>0 of an on-line service 

10 that supports adaptive logging aceording:to<J&e; p^ 

100 includes log server 1 ip, ; peysigrteat =log store. 1 15,, application servers 120, r.. t 
130, 140, system administrated SQ T and network 160. System administrator 150 
includes an adaptive jogging pontTQller k55s:<i.<h.z 7 v _ ;n v i r-\ 
- _ In .a^cordance-with pne embodiment of the present invention, adaptive : j 

1 5 logging controller , 1 55 allows a system^dministrator to set or change an initial a. 

logging level and to set or change flush policy: criterion for forwarding local log 
information from an application server 120-140 to a persistent log store 115. A 
system administrator can set the initial logging level and flush policy for each 
application server, individually, in a distributed fashion. In this way, the system 

20 administrator can tailor or tune the ^amount and,; type of logging information 

collected l^dly and. fprwardgd frdm^each, application server 120-140 to log : 
server 1 10 for storage in log store 115. Moreover, the initialilogging level can be 
changed independent . of the flush policy, criteria. Thus^ the amount and type of 
information which is logged locally can be controlled independent of the criterion 

25 used to control the forwarding of the information to a persistent log store; This 

operation is described further wjth; respect to FIGs. 2, 3 A,.-and 3B. v^r: 

Network 160 interconnects log server 1 10, log store. 115, application 
servers 120, 130, 140, and system administrator 150. Log server 115 is also 
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coupled to log server 1 10 through a local connection 1 17 (or through a link in 
network; 160). One or more users 170 are ; coupled through network 160 to any 
of application servers 120, : 130 or 140. Users 170 can be any type of end user 
device, including but not limited to, a personal computer, modem, telephone, 
television, set-top box, video game console,, personal data assistant, or other 
terminal. v „ '.-vr ■ . • - >. . 

.Each of the, applications servers 120, 130, 140 , and/or users ! 70 can 
execute one or more applications. , For example, application server 130 can 
support one or more multi-player games. The functionality required to execute 
a game.can be divided in any proportion ^be^een an application server and a user 
depending upon ^particular gaming application ; and the available resources in 
application servers 120* 13 0* 140 and users J 70, Users ,170. can connect to, 
application server 130 to play an interactive multi-player game over network 1 60; 
Network 160 can be T any OTmmunication : network (voice and/or,, data) or 
combination of networks including, but not linotited to, the Internet : Users 170 
can match themselves or be matched automatically by a separate .matchmaker 
server (not shown). -Users, 170 : can be coupled to . one another through any 
communication link, indudingbutnotl^ 160. Links 

between users 170 can be client/server links through qnet or, application servers 
120, 130,-140, Peprrto-peer or direct links between users 1^0 can also be used. 

Application server? 120^40,, and- users. 1>7Q : each generate, logging 
infQrmation. : Log g ing, information, .also ^called -logging messages* can be 
generated by the applicadpm, servers y us^ device. This 

logging information can include different types or leyels of logging information. 
These levels can be prioritized depending upon impact upon system performance, 
user experience or other criteria. For example, levels of statistical, debug and 
error logging information can be prioritized to range? from a low priority to a high 
priority. J{ <. ... , ,.- 

FIG. 4 shows an. example logging message 400, Logging message 400 
includes four fields 402-408. Fields 402 and 404 are used* to Identify a log 
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source. Global universal identification field 402 contains a global identifier 
number (GUID). Class field 404 identifies a particular class. Log event level 
field 406 identifies the priority level of the logging message, 5 e.g:, Debug 9, a 
ninth level of debugging; Log content field 408 contains- logging information 
associated with the individual' logging message 400: For example, log Content ' r 
field 408 can contain a text message "Service Problem" as shown in FIG. 4: FIG. 
5 shows an example table of 20 priority levels of logging information including 
statistical, debug and error logging ^ 

messages are-illustrative arid hot intended to -limit : ihel present invention. ? In : 
general, any typeof logging irifessage of fixed 6r variable length Can be used in 
the present invention. Aspe^ialn^espak&cto 

logging information 'according to a separate! feature bf the present invention as 
described below: pry c wy iv. - » >i ; c ~ ^. s f/^.- : 

FIG. 2 is a more detailed diagram of applicatioh r sierver 130 with adaptive' 
logging according to one embodiment of the present irivehfidn: Application 
s erver 1 30 includes client proxy 2 1 0, local lbgxache 21 5, property manager 23 0; 
class logger 240; node logger 250- arid a ri&ne domain manager 260- r Client 
proxy 210 is software or logic used to communicate with a user 170 to support 
the interactive applications hosted or supported by application server 13 0. Pieces 
of conterif 220 repres ent different fiinctibris ■ in one or iribre active, interactive 
applicatioris hoisted or supported by application server 130. : : 

^ Ari interactive application can include, but is hot limited td, a multt-player 
matching se^ clarity; the present invention 

is described with respect to ari applied Written in ari object-oriented (OO) 
pfdgrariiming iMguage such as Java.^ 'An OO larigiiage includes different 
functions or operiti6ris in classes? The present iriveritiori is riot intended to be so 
limited, however, and cari be applied to any prograriiriiing language* including 
procedural or other non-OO languages. ' 5 

A class logger 240 is assigned for each class of the pieces of content 220. 
FIG. 2 6nly> shows one class logger 240 for clarity. However, multiple class 
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loggers 240 are used when multiple classes are involved. Property manager 230 
in response to commands from system administrator 1 50 defines which pieces of 
content 220 are active and assigns class loggers 240. Class logger 240 receives 
and filters each logging event in a respective class. Class logger 240 then 
5 forwards the Filtered logging events to local log cache 215. Node logger 250 

reviews logging events and determines whether a flush policy criteria is met. 
Node logger 250 forwards the logging information stored in local log cache 215 
to log server 1 10 when the flush policy criterion is met. Name domain manager 
260 is used to control the registration of different names in a special name space 
10 based on class names according to a further feature of the present invention. 

Adaptive logging of the present invention, however, is not limited to use of a 
special name space and can be run without a name domain manager 260 or any 
particular name space. The operation of application server 130 and each of its 
components 210-260 is described further with respect to FIGs. 3A and 3B, 

FIGs. 3A and 3B are flowcharts of a routine 300 for adaptive logging 
according to one embodiment of the present invention. Routine 300 includes 
steps 302- 380. 

A, Initialization 



15 



20 



25 



Steps 3 02 and 3 04 relate to the initialization of adaptive logging according 
to the present invention. In step 302, initial logging levels are set for each class. 
Each class logger 240 is set to an initial respective logging level. The initial 
logging levels can be the same or different for different class loggers 240 
depending upon which levels of logging information need to be logged for a 
particular class. In step 304, a flush policy is set. The node logger 250 is set to 
an initial flush policy criterion. Application server 130 can perform these steps 
in response to commands received from adaptive logging controller 155 or can 
initialize based on default values. For example, a system administrator, through 
the adaptive logging policy controller 155, can setan initial logging level of class 
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logger 240 to "Debug 1" or the lowest priority level at which logging begins. 
Node logger 250 can be set to flush if 3 or more error messages are received in 
less than one hour 

B. Logging Activity 

5 In step 310, logging activity occurs. The broken line between step 304 

and 310 indicates this can be an asynchronous event depending upon when a 
piece of content 220 begins. "As shown in FIG. 3B, when logging activity occurs, 
steps 320-380 are carried out in accordance with the initialization steps 302 and 
304 performed earlier! In step 320, log events generated by a piece of content 

1 0 220 are sent to class loggers '240! Class loggers 240 filter the log events based on 

the initial logging levels set in step 302 (step 330). Class loggers 240 forward all 
filtered log events which equal or exceed the initial logging level set in step 302 
to a local log cache 215 (step 350). Altematively, class loggers 240 can forward 
theTiltered log events to node logger 250 for review and storage in local log 

15 cache 215. 

In step 360, a check is made by node logger 250 to determine whether a 
flush policy criterion set in step 304 has been met. For example, an initial flush 
policy of three error messages within one hour might be set in step 304. Using 
this example, if node logger 250 determines that three or more error messages 

20 haveiieen received in less than one hour in step 360, then node logger 250 flushes 

log cache 2 15 (step 380); In particular, the filtered log events stored locally in 
local log cache 215 are forwarded to log server 110. Log server 1 10 stores the 
filtered log event information in persistent log store 115. 

If node logger 250 determines that a flush policy criterion has not been 

25 met in step360, node logger 250 checks for a change in flush policy (step 362). 

If ho change in flush policy has been made, then the routine 300 discards the 
contents of local log cache 215 (step 364) and proceeds back to step 320 to 
process additional log events. If a change in flush policy has been made, then the 
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flush policy of node logger 250 is updated (step.370). Routine 300 then proceeds 
to step 320, to continue processing log events according to the updated flush 
policy criterion. In general, step 364 can be performed after step 3 62 as described 
above, or after any indication of a positive user experience or expiration of a time 
interval that occurs when a flush policy criterion has not been met 

■ FIG. 6 is anexample computer system and computer program product in 
which the present invention is implemented primarily in software. : , 

. • Routine 300 and each, of its constituent steps 3 02-3 80 can be implemented 
primarily in hardware, firmware, software, and any combination thereof FIG. 2 
is a f block diagram of an, embodiment of the present invention implemented - 
primarily in an application server 130 according to the presentinvention; FIG. 6 
is aa, example compute^ system ; 60 present invention is 

implemented primarily in software, :j ; v : iMnc^-v-r . ? : * 

An example of a computer system 600 is shown in FIG. 6 . The computer 
system 600 represents any single or multiTprocessbr computer. Single-threaded 
and, multithreaded computers can be used. rUnified or distributed memory 
systems can be used. ... . , ; ,• v.v-v ->jr.*>. : ..r . s ■ = ;v 

The computer system <600 includes one or more processors, such as^ 
processor 604, One or more processors 604 can execute software implementing 
routine 3Q0 ri as ] described: above. , - Each processor ;604 is 3 connected to a 
communication infrastructure 602 (e:g.,= avcommimications 1ms, cross-bar, or 
network). Various -software embodiments- are ^described int terms: of this 
exemplary computer system. After ; reading this: description, it will become 
apparent to a person skilled in the relevant art how to implement the invention 
using other comp;uter systems and/or computer architectures:- • ^ 

Computer system 600 also: includes a main memory 608,rpreferably 
random access memory (RAM), and can also include a secondary memory 61Q, 
The secondary memory 610 can include, for example, a hard disk drive 612 
and/or a removable storage drive 614, representing a floppy disk drive, a; 
magnetic tape drive, an opticaldisk drive, etc. The removable storage drive 614 
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reads from and/or writes to a.removable storage unit 6 18 in a well known manner. 
Removable storage unit 618 represents a floppy disk, magnetic tape, optical disk, 
etc., which is read by and written to by removable storage drive 614. As will be 
appreciated- the removable storage unit 618 includes a computer usable storage - 
medium having stored' therein computer software and/or data. ' r • -■ " 1 : 

In alternative embodiments, secondary- memory^ 6-10 may include other 
means for allowing computer programs or other instnlcti6ns : to be loaded into 
computer system 600. Such means can include, for example, ^removable storage 
unit 622 and an interface 620. .Examples, can includie a program cartridge and 1 ) 
cartridge interface .(such as that found irr video game 1 devices),, a removable 
memory chip (such as an EPROM, or PROM) and associated^ socket, and other : 
removable storage units 622 and interfaces 620 v^hich allow software and data to 
be transferred from the removable storage unit 622? to computed system 600: 

Computer system 600 can also include a communication 624. 
Communications interface 624 allows software and data to be' transferred between 
computer ,system 600 and: external -devices via immunisations path 626. 
Examples of communications interface 624 can include a fnodem, a network 
interface (such as Ethernet card)? ^communications port, etc; Softwareand data 
transferred via: communications interface 624 are in the form of signals which can 
be electtomc,rjelectrom&gnetic,;0^ 

by communications interface. 624; via communications path 626. -Note that 
comm\inications?interfacei624|jrovides a means by which cbmpiuter system 600 
can interface to a network such as therlnternet/ * ? 1 

ri ^vThepresem!.invention4»n , 'be implemented using software 1 running (that 
is, executing) in an environment similar to that described above with respect to 
FI<3\.6v In this document; 'the termr "computer program 1 product" is iised to 
generally refer to removable storage unit 61:8, a hard disk installed iri hard disk 
drive 612, or ; a canier wave carrying software over a communication path 626 
(wireless Jink or; cable) to ^communication interface; 624: A computer useable 
medium can; include magnetic media, optical media, or other recordable media, 



WO 00/47003 



PCT/USOO/01623 



-14- 

or media that transmits a carrier wave. These computer program products are 
means for providing software to computer system 600. 

Computer programs (also called computer control logic) are stored in 
main memory 608 and/onsecondary memory 610. Computer programs can also 
be received via communications interface 624. Such computer programs, when 
executed, enable the computer system 600 to perform the features of the present 
invention as discussed herein. In particular, the computer programs, when 
executed* enable . the processor 604 to perform the features of the present 
invention. Accordingly; such computer: programs represent controllers of this 
computer system 600. ;o ■ ^? n "... v-. H :.: 

In an embodiment where the invention is implemented using software, the 
software may be stored in a computer.program product and loaded into computer 
system 600 using removable storage drive 614, hard drive 612,or 
communications interface 624. Alternatively, the computer program product may 
be downloaded to, computer system.60Q over communications path 626. The 
control logic (software), when executed by - the one or more processors 604, 
causes the processors) 604 to perform the functions of the invention as described 
herein: - 1 < y - ( : -.:v j : ,^.:,n:c r .-.-.r ^t- r , ;u 

* : i ln another embodiment, the invention t is "implemented primarily in 
firmware and/or hardware using, for example, hardware components such as 
application specific integrated circuits (ASICs).-: Implementation of a hardware 
state machine so as to perform the functions described herein will be apparent to 
persons skilled in the relevant art(s)ni $r z'uy:-? ^. o ^ « • : . *■[ -y. > 

IV Special Name Space 

A special name space can also be used to enable a system administrator 
to control the filtering of log events. In particular, a special name space can be 
used to formulate a command that identifies the initial log level. For example, 
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a command can be sent from adaptive policy controller 155 that identifies an 
initial log level as described above with respect to FIG. 5 . 

. -Alternatively, according to a further feature, a command can identify a 
logging level using a refined. name' space based an the names of the classes (in 
other, words; based on class names). .Name>domain:manager 260 manages 
registration ; (addition and deletion) of names' in the : refined name space. - 
Preferably, the name space includes many or all of the class names in use in the 
pieces. ; of content 220. ^ An asterisk or other symbol can be used to identify an 
open range of classes. Foriexample, in the case of an on-lineservice* a command 
to set or change an initial logging level might be as follows : - - 

r-. . wm.eompatayname.sersrrcenam - .r; ~ 

where "company name M can be any company name (ue.,>S6ny); "service name" 
can be any sei^ice iname ? (i. e.; games jeopardy), M serverrname"- can be any 
application server name (i.e Mpatkserver 1), and "class 1 " can be any class (i.e., : 
automatching class representing matchmaking content)^ The asterisk represents 
an open query that encompasses all other classes. In this example, the initial 
logging level will be alUogging events for classes associated with the command : 

_ j"com:companyname.sei^icename.se * i ~> ' 

This example is illustrative. As would be apparent to a person skilled in the art 
given this description other refined name spaces and examples could be used. 
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V. Conclusion 

While specific embodiments of the present invention have been described 
above, it should be understood that they have been presented by way of example 
only, and not limitation. It will be understood by those skilled in the art that 
various changes in form and details may be made therein without departing from 
the spirit and scope of the invention as defined in the appended claims. Thus, the 
breadth and scope of the present invention should not be limited by any of the 
above-described exemplary embodiment but .should be defined only in 
accordance with the following claims and their equivalents. 
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What Is Claimed Is: 

1. " A method for adaptiveiy logging, comprising the steps of: 

' (a) ' filtering logging events based on at least one initial logging 
level;' y: ~ r ' ' 1 - '-' :v " ' ' ' ' ' ^ " ' 1 ' ' ' ; " 

(b) storing the filtered logging events; 

(c) detehninirig whether the filtered iogging events meet a 
flush pdiicy criteria; and' ^ 

(d) fiusiiingthe filtered logging ^events stored" in step (b) when 
the flush policy criteria is met in step (c). : / 

2. The method of claim 1, further comprising the steps of: 

(i) setting the at least one initial logging level; and 

(ii) setting the flush policy criteria. 

3. The method of claim 2, wherein said step (i) comprises sending 
a first command to set the at least one logging level from a remote system over 
the Internet to a first server; and said step (ii) comprises sending a second 
command to set the flush policy from the remote system over the Internet to the 
first server. 

4. The method of claim 3, further comprising the step of defining 
said first command in a name space based on class names. 

5. The method of claim 1, further comprising the steps of: 

(e) changing the flush policy criteria during logging activity; 

and 

(f) flushing the filtered logging events stored in step (b) when 
the changed flush policy criteria is met; whereby, the number of filtered logging 
events forwarded to a remote log server can be adaptiveiy increased or decreased. 
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6. The method of claim 1, wherein said flushing step (d) includes 
forwarding the filtered logging events, stored in step (b) to a remote log store. 

7. The method of claim 1 , further comprising the steps of: 

(e) changing the at least one initial logging level during 
5 logging activity; whereby, the number of logging levels passed through said 

filtering step (a) and stored in said step (b) can be adaptively increased or 
decreased. 

8. The method of claim 1, wherein the logging events comprise 
classes of logging events, apd wherein eaph of said steps, (a) to (d) are performed 

10 at a first server remptefrom a log server, and said step (a) comprises filtering 

each class of logging events based on a respective initial, logging level; said step > 
(b) stores the filtered logging events on aper glass basis; said step (c) stores the : 
filtered logging events locally at the first server, and said step (d) comprises > 
flushing the stored filtered logging events from the first server to the log server 

1 5 when the flush policy criteria is met for, a respective class . 

9. The method of claim ,8, .\vherein the first server jromprises an (i 
application server in an on-line, multi^player gaming or f phat : service,- the* 
application server executing a pirce.pf .^nten^ 

of generating the logging events during the execution of the piece of content prior 
20 to said filtering step (a),,. . i: r ; v < rn f I ' * 

10. A systern for adaptively logging ai a node, comprising: : : v ,-, 

at least one local log cache; : . I} r ^ m v - 

at least one class logger,, coupled to said ; at, least one local log;: 

cache, wherein each class logger filters logging events for a respective class of 
25 logging events based on at least one initial logging level and forwards the filtered 

logging events to a respective at least one local log cache for storage; and 
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a node logger, coupled between each local log cache and a remote 
log server, -wherein said node logger determines whether a flush policy criteria 
is met and flushes the stored filtered logging events to the remote log server when 
the flush policy criteria is met 

5 * 11. The system of claim 10, further comprising: 

an adaptive logging controller that ehables at least one initial 
logging level to be set for each respective class logger and to set a flush policy 
criteria for said node logger. 

12. >" ■ The system of claim 1 1, wfeteihthe adaptive logging controller ' 
1 0 sends a first command to set the at leak otie' loggin^ lev^l from a remote system 

administrator o vet the Internet to 6ach class logged kiid serids a second command 
to set the flush policy from the remote system adftiihisWkor over tlie internet to 
said* node logger. - -~ ' <'**' n "* 1 ' - v ' : '~ ' x - ' ' 

13 . The system of claim 1 1 , whierein said adaptive logging controller 
1 5 enables the flush policy criteria to be changed during logging activity such that 

said node logger' flushes the stored' filtered logging events when the changed 
flush policy criteria is ^t^ whereby, the rtumber df filtered log;^ng" events 
forwarded to i remote log server can be adaptively increased or decreased. 

14. The system of claim 1 1 , wherein said adaptive logging controller 
20 enables the at least one initial logging level at respective class loggers to be 

changed during logging activity suirh that eabh class logger filters said logging 
events based on the changed initial logging -levels; whereby! the number of 
logging levels can 1 be adaptively increased ' : 
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15. The system of claim 11, wherein the logging events comprise 
classes of logging events, and each class logger receives a respective class of 
logging events. 

^ - 16. . A system for adaptively logging, comprising: 
5 (a) means for filtering logging events based on at least one 

initial logging leyel; . , , ■ ■ * 

(b) means for storing the filtered logging events; 

(c) means for determining whether the filtered logging events 
- meet a flush policy criteria; and 

10 (d) means for flushing the fi ltered logging events stored in sai d 

storing means (b) when the; flush policy criteria is met as determined by said 
determining means (e). i ? : . , is - m i : ; ..™ * 

A7- v; The system of claim 16, further comprising: > 

(i) means for setting or changing the at least one initial 1 
15 logging level; and - . , r , : m 

(ii) means for setting or changing the flush policy criteria. 



. 18. . A. computer program product* comprising a r eomputer useable 
medium haying computer program; logic for enabling atleast one processor in'a 
computer system to, provide adaptive logging; said computer program logic 
20 comprising: , t( rr . ♦ «. u :i v„; :-<•.. \ -u^r::^''. a ■.-..•>. . 

j \ means for enabling the at least one processor to filter logging 

events based on at least one initial logging level; ; c , - i . ; . v>*\ . ?• 

. means for enabling the at least one processor to forward ; the 
filtered logging events for storage; 
25 , -\ means for enabling the at least one processor to determine whether 

the filtered logging; events meet a flush policy criteria; and - ; • 
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means for -enabling the at least one processor to flush the filtered 
logging events when the flush policy criteria is met. 

19. The computer program product of claim 1 8, further comprising: 

(i) means for enabling the at least one processor to set or 
5 change the at least one initial, logging level; and ■ " 

(ii) means for enabling the at least one processor to set or 
change the flush policy criteria.: v , w; ^.vi, 

20. An on-line ! service. 1^ over a network, 
comprising^ . x . xr . . :J ■. : ,> ^x:.;iV.\ >>\.vn : i \'<> 

1° t ■ a^ . application server at a node in the network; ( - 1 

an adaptive logging controller coupled over the network to said ^ 
application server; 

a log server coupled over the network to said application server; 
and ,;., , . . r> * . .u: v: < • ■. <r i :. ^- 

15 a log store coupled to said log server; ^ ^ 1 1 - 

; wherein said application server includes: t 
at least one local log cache; 
7. /:':---:fttlfsast one-class loggers coupled to said at least one local log 
cache, wherein each cl^s logger filters logging events for a? respective class of : 
20 logging ^ye^ts^based on at least one initial logging level and forwards the filtered 

logging events to a respective at least one local log cache for storage; 'arid 1 - '* 

: 9 . -anode; logger, coupled betweeneaeh loeal-lbg cache and said log 

s erver, wherein said node logger determines whether a flush policy criteria is met 
and. flushes the stored filtered logging events to said* log Server when the flush 
25 policy criteria is met; and ■ f ; . > r ' 

; . wherein said adaptive, logging controller enables said at least one initial 
logging level to be set or changed for each respective class loggerand enables a 
flush policy criteria to be set or changed for said node logger. 
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21. A method for adaptive logging of logging events, comprising the 
steps of; 

. (a) . setting or changing an initial logging level for the logging 

events; and ■ i '■ 

* j • 

K , ....... ,(b)^ setting or changing a flush policy for the logging events 

independent of said step (a). 
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